In a message dated 11/09/2001 09:12:15 GMT Daylight Time,
[log in to unmask] writes:
<< I believe that the employer would still be the data controller as most
employees would sign a contract with the employer and within that contract
(at least as far as this Council is concerned) normal procedure would be a
referral to OH if there is a recurring problem with absence - therefore the
data subject by signing the contract agrees to that practice. Please
correct me if I am wrong. >>
----------
[Sorry for the delayed response I have been away.]
If the employer is the data controller, then the data controller will need
explicit consent for processing the sensitive data as the exemption for
"legal requirement" specifically excludes any requirement by way of contract.
If the OHP is the data controller then he/she will not need explicit consent
as they would be able to use the exemption covering medical practitioners
under a duty of medical confidentiality.
I was only trying to help.
Ian Buckland
MD
Keep IT Legal Ltd
Please Note: The information contained in this document does not replace or
negate the need for proper legal advice and/or representation. It is
essential that you do not rely upon any advice given without contacting your
solicitor. If you need further explanation of any points raised please
contact Keep I.T. Legal Ltd at the address below:
55 Curbar Curve
Inkersall, Chesterfield
Derbyshire S43 3HP
(Reg 3822335)
Tel: 01246 473999
Fax: 01246 470742
E-mail: [log in to unmask]
Website: www.keepitlegal.co.uk
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
www.jiscmail.ac.uk/user-manual/summary-user-commands.htm
all commands go to [log in to unmask] not the list please!
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|